Interface expansion device for a network device

ABSTRACT

The claimed interface extension device is based on a network device (DCC) having at least one previously unoccupied digital data output (OUT), to which an interface extension module (IOE) having at least one supply voltage input (S) and having a plurality of digital interfaces is coupled in the claimed manner. In this way, the supply voltage input (S) of the interface extension module (IOE) is interconnected with the digital data output (OUT) of the network device (DCC), so that in event of an error, the interface extension module (IOE) and all the digital interfaces thereof can be switched off. In addition, by measuring the sum current flowing through the outputs of the interface extension module, the load diagnosis capacity of the network configuration can be extended to the interface extension device. The claimed interconnection of the supply voltage input (S) of the interface extension module with the digital data output (OUT) of the network configuration has the advantage of also implementing a fail-safe behavior for conventional interface extension modules.

CROSS REFERENCE TO RELATED APPLICATIONS

The present patent document is a § 371 nationalization of PCTApplication Serial Number PCT/EP2016/061288, filed May 19, 2016,designating the United States, which is hereby incorporated by referencein its entirety. This patent document also claims the benefit of DE102015211478.3, filed on Jun. 22, 2015, which is also herebyincorporated by reference in its entirety.

FIELD

Embodiments relate to an interface expansion device for a networkdevice.

BACKGROUND

In safety-relevant networks, such as in automation installations or inthe automotive vehicle sector, for example, safety-relevant data istransmitted even in the case of faults in hardware components ortransmission paths. In safety-relevant networks, the operation of aplurality of network devices connected in a ring-shaped topology isknown.

A further measure for increasing safety is provided by redundant dataprocessing within a network device. A network device, also known as aduplex controller, includes control devices operating in parallel, e.g.microprocessors operating in parallel or else microprocessor cores of amulti-core processor operating in parallel, on which redundant dataprocessing is performed on two isolated execution lanes. Two processesassociated with a respective execution lane monitor one another withrespect to the data supplied and the data guided away. In the event of adeviation, a fault is identified, and the results calculated on the twoexecution lanes are discarded. Such a measure is referred to asfailsafe.

To provide more stringent fail-operational behavior, there mayadditionally be a further control device operating in parallel to takeover the control operation in the event of the aforementioned deviation.

Network devices of the aforementioned type may be used insafety-relevant networks in the future, for example in the vehiclesector, and are currently being developed in the RACE (Robust andReliable Automotive Computing Environment for Future E-Cars) project.The network devices may include a plurality of digital interfaces, e.g.digital inputs and/or outputs, that are provided with redundant safetymechanisms.

In practice, however, the need for digital interfaces, for example forthe purpose of integrating different modules, sensors and actuators,often exceeds a number of interfaces provided by the network devices.Compensation for the lack of interfaces by adding additional networkdevices and using the digital interfaces of the additional networkdevices often fails for reasons of cost.

Furthermore, to optimize a cable harness in a vehicle, a plurality ofinterface modules or I/O (input/output) modules may be distributed in avehicle and thus may include short cable connections between interfacemodules and units connected thereto. Adding additional network devicesmay exceed a prescribed budget.

In contrast, the use of commercially available interface modules, forexample by multiplex operation of a plurality of interface modules at aninterface of a network device, is not compatible with the overall safetyconcept of the network, since commercially available interface modulesare not suitable for ensuring the aforementioned safety mechanismswithout providing additional measures.

SUMMARY AND DESCRIPTION

The scope of the present invention is defined solely by the appendedclaims and is not affected to any degree by the statements within thissummary. The present embodiments may obviate one or more of thedrawbacks or limitations in the related art.

Embodiments provide an interface expansion device, that has safetymechanisms of a safety-relevant network.

The interface expansion device is based on a network device including atleast one previously unassigned digital data output, to which aninterface expansion module including at least one supply voltage inputand including a plurality of digital expansion interfaces is coupled.The supply voltage input of the interface expansion module may beinterconnected with the digital data output of the network device, withthe result that, in the event of a fault, the interface expansion modulewith all of the expansion interfaces thereof may be disconnected.

The interconnection of the supply voltage input of the interfaceexpansion module with the digital data output of the network deviceprovides failsafe behavior for conventional interface expansion modulesas well. In the event of a fault identified by the network device, theredundant safety mechanisms of the network device may also safelydisconnect the expansion interfaces of the interface expansion module.All interfaces, for example, outputs, of the interface expansion modulesare disconnected by disconnecting the data output, which delivers thesupply voltage to the interface expansion module. The disconnection alsooccurs, for example, if the interface expansion module is faulty. Theinterface expansion device thus provides the required safety mechanismsof the safety-relevant network.

Although simultaneously disconnecting all the expansion interfaces ofthe interface expansion module does not ensure optimum availability ofthe expansion interfaces within the context of fail-operationalbehavior, a safe failsafe state in the event of a fault may be provided.

If fail-operational behavior is required for individual expansioninterfaces in the event of a fault, the expansion interfaces are keptavailable on a redundant basis in accordance with an embodiment. Theexpansion interfaces are configured in a redundant manner such that thesecond expansion interface that is redundant with respect to a firstexpansion interface is actuated by a second network device that isexpanded using the interface expansion device.

In an embodiment, a load diagnosis device that is associated with thedata output of the network device, for measuring a summation current ofall the partial currents of the expansion interfaces of the interfaceexpansion module that flow via the digital data output of the networkdevice is used. The measure provides the possibilities of load diagnosisthat is implemented for data outputs of the network device to also beopened up for the expansion interfaces, for example, for the dataoutputs of the interface expansion module.

Load diagnosis provides identification of an interruption of the lineconnection to a load connected to the data output or provides a shortcircuit of the data output, to which the load is connected, with respectto a supply potential or with respect to a reference-ground potential.The load diagnosis may be used to measure the current that flows via thedata output for diagnosis purposes.

A connection of the expansion module may be used to perform loaddiagnosis over all the expansion interfaces of the interface expansionmodule. Although the loads at each individual expansion interface maynot be detected independently, the detection of a total load allowsconclusions to be drawn about the load of each individual expansionmodule via the sum of the currents flowing:

Switching a data output of the expansion module leads to a change in thesum of the current flowing, with the result that load diagnosis alsoallows conclusions to be drawn about the load of individual data outputsof the expansion interfaces.

Measuring the consumption of the entire expansion module permitsconclusions to be drawn about individual expansion interfaces by solvingthe following equation for the total power Ptotal:

${Ptotal} = {{Pmodule} + {{switching}\mspace{14mu}\eta{\sum\limits_{1}^{n}\;{{staten}*{Pn}}}}}$where:

Pmodule=self-consumption of the expansion module

n=number of outgoing expansion interfaces

η=efficiency of outgoing expansion interfaces

switching staten={in|out}

Pn=power of the load connected to the expansion interface n

Deviations from the condition indicate the fault in a load. Briefswitching of individual expansion interfaces makes it possible todiagnose, in a targeted manner, which expansion interface or which loadconnected to the respective expansion interface is faulty, if it is notpossible to identify the fault already using the above formula bydifferent current recordings of the various loads or the switchingprocesses resulting from the operation.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 depicts a schematic illustration of an embodiment of an interfaceexpansion device.

FIG. 2 depicts a schematic illustration of an embodiment of an interfaceexpansion device.

DETAILED DESCRIPTION

FIG. 1 depicts an embodiment of an interface expansion device. In theembodiment, a network device DCC, also known as a duplex controller,includes control devices (not illustrated) operating in parallel, e.g.microprocessors operating in parallel or microprocessor cores of amulti-core processor operating in parallel, on which redundant dataprocessing is performed on two isolated execution lanes LA, LB.

A first execution lane LA is at least temporarily connected to a firstcontrol input E1 (Enable) of a network-device-internal interface modularunit IOI. A second execution lane LB is at least temporarily connectedto a second control input E2 of the network-device-internal interfacemodular unit IOI.

Only one load connection terminal pair S, D is depicted for theinterface modular unit IOI, where a first load connection terminal S isconducted to the outside as a digital data output OUT of the networkdevice DCC. The first load connection terminal S corresponds, forexample, to a source terminal of a semiconductor power switch. In theconfiguration, a second load connection terminal D is connected to thesupply potential V of a voltage supply by a load resistor RL. The secondload connection terminal D corresponds, for example, to a drain terminalof a semiconductor power switch.

All the digital data outputs of the network device DCC (only one dataoutput OUT is depicted in FIG. 1 for clarity) are actuated by the tworedundant execution lanes LA, LB of the network device via the interfacemodular unit IOI. Merely actuating the redundant control inputs E1, E2by the two execution lanes LA, LB leads to the switching of an outputOUT actuated. In an embodiment, an output actuated in this way may beread-back on a two-channel basis in order to be able to identify theswitching state reliably.

A further measure for increasing safety is provided by load analysis ofthe digital data output OUT. In load diagnosis, the current that flowsthrough the data output OUT is measured in order to identify whether aload connected thereto is operating correctly.

Corresponding safeguarding measures are also provided on the input sideof digital inputs (not illustrated) of the network device DCC. A digitalinput is read-in on a two-channel basis. Faults may be identified with avery high degree of probability to reliably rule out undesiredswitching-on of consumers within the context of a failsafe measureand/or to identify a faulty consumer. The latter is a prerequisite forfault identification and a suitable reaction to a fault.

A load diagnosis device M is connected in parallel with the loadresistor RL and provides identification of an interruption in the lineconnection to a load connected to the data output OUT or provides ashort circuit of the data output OUT, to which the load is connected,with respect to a reference-ground potential GND (ground) or withrespect to the supply potential V. The load diagnosis device M may beused to determine the current that flows through the data output OUT bymeasuring a voltage UL dropped across the load resistor RL. The loaddiagnosis device may optionally be configured on a two-channel basis.

In an embodiment, an interface expansion module IOE is connected to thenetwork device DCC to the effect that the supply voltage input S of theinterface expansion module IOE is not connected to the supply potentialV of the voltage supply (e.g., in vehicles, terminal 15 or terminal 30),but instead, is connected to the digital data output OUT of the networkdevice DCC. The individual interface ports, e.g. digital inputs and/oroutputs, of the interface expansion module IOE are not depicted in FIG.1 for reasons of clarity.

In FIG. 1 , a load connected to the digital data output OUT, with theload formed by the interface expansion module IOE, is positioned betweenthe first load connection terminal S of the semiconductor power switchand the reference-ground potential GND. The configuration may bereferred to as a high-side switch.

FIG. 2 depicts an alternative embodiment of the digital data output OUT.In FIG. 2 , a load connected to the digital data output OUT, with theload being formed by the interface expansion module IOE, is positionedbetween a second load connection terminal D of the semiconductor powerswitch and the supply potential V. The configuration may be referred toas a low-side switch.

In the configuration of the digital data output OUT as a low-side switchin accordance with FIG. 2 , a load diagnosis device M is connected inparallel with the load resistor RL. The load diagnosis device M providesidentification of an interruption in the line connection to a loadconnected to the data output OUT or provides a short circuit of the dataoutput OUT, to which the load is connected, with respect to the supplypotential V. The load diagnosis device M is used to determine thecurrent that flows through the data output OUT by measuring a voltage ULdropped across the load resistor RL.

Although the redundant data processing within the network device DCC,e.g. the redundant execution lanes LA, LB, and an implementation ofmicroprocessors operating in parallel or else microprocessor cores of amulti-core processor operating in parallel expand the safety measures tothe interface expansion device, embodiments are not restricted to theimplementation of the network device as a duplex controller, asdescribed in the embodiment. Embodiments provide for use innon-redundantly designed network devices of any type (e.g., based on asingle microcontroller). It is to be understood that the elements andfeatures recited in the appended claims may be combined in differentways to produce new claims that likewise fall within the scope of thepresent invention. Thus, whereas the dependent claims appended belowdepend from only a single independent or dependent claim, it is to beunderstood that these dependent claims may, alternatively, be made todepend in the alternative from any preceding or following claim, whetherindependent or dependent, and that such new combinations are to beunderstood as forming a part of the present specification.

While the present invention has been described above by reference tovarious embodiments, it may be understood that many changes andmodifications may be made to the described embodiments. It is thereforeintended that the foregoing description be regarded as illustrativerather than limiting, and that it be understood that all equivalentsand/or combinations of embodiments are intended to be included in thisdescription.

The invention claimed is:
 1. A system comprising: a network device, thenetwork device comprising at least one digital data output and a loaddiagnosis device that is associated with the at least one digital dataoutput, the load diagnosis device configured to detect a fault as afunction of a deviation in a summation current of all partial currentsof a plurality of expansion interfaces of an interface expansion modulethat flow via the at least one digital data output of the networkdevice; and the interface expansion module, the interface expansionmodule comprising a plurality of expansion interfaces and at least onesupply voltage input that is interconnected with the at least onedigital data output of the network device to receive a supply voltage;wherein in the event of the fault detected by the network device, the atleast one digital data output and the interface expansion module withall expansion interfaces of the plurality of expansion interfaces aredisconnected.
 2. A method for operating an interface expansion devicefor a network device, the interface expansion device comprising at leastone digital data output, the interface expansion device furthercomprising an interface expansion module, the interface expansion modulecomprising at least one supply voltage input and a plurality ofexpansion interfaces, at least one supply voltage input of the interfaceexpansion module being interconnected with a digital data output of theat least one digital data output of the network device, the methodcomprising: measuring, by a load diagnosis device that is associatedwith the digital data output, a summation current of all partialcurrents of the plurality of expansion interfaces that flow via thedigital data output of the network device; detecting a fault event bythe load diagnosis device as a function of the measurement; anddisconnecting, after detection of the fault event, the digital dataoutput and the interface expansion module with all expansion interfacesof the plurality of expansion interface.
 3. The method of claim 2wherein the fault event is detected if no change in the summationcurrent is measured when switching at least one outgoing expansioninterface of the interface expansion module.
 4. The method of claim 2wherein the fault event is detected if the summation current measured bythe load diagnosis device does not correspond to an expected summationcurrent of all partial currents that flow via the digital data output ofthe network device.
 5. The method of claim 2 wherein the fault event isdetected if the summation current measured by the load diagnosis devicedoes not correspond to an expected summation current of all partialcurrents that flow via the digital data output of the network device.